Move getKey() from request query parameters to body

[alan-fang]

This https://stackoverflow.com/questions/25385559/rest-api-best-practices-args-in-query-string-vs-in-request-body suggests that key should not be passed as a query parameter, but rather in the request body.

[tko22]

i think it would depend on the authentication server stuff. Most likely, from what I remember, it would be in the header under the Authorization: Bearer header